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www.datakom.de 


NetworkOuality  for  customers. 


DATAKOM 


(Mother  Company  of  GTEN) 


Innovative  Test-,  Analyzing  and 
Performance  Management-Systems 
for  Voice  - and  Data  Networks 

+ Training  and  Consulting  Services 


1986  founding  of 
DATAKOM 
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History  DATAKOM/ GTEN 


2000/2001  Founding  of  GTEN  AG 

• Take  over  of  Technology,  Patent,  rights  and 
obligation  contracts 

* Contract  with  large  Carrier  in  Germany  for  LI 
Service 


1999 


Contract  with  Mannesmann 
ARCOR,  Deutsche  Telekom 
und  o.tel.o 


1997 


Development  of  the 
G10-LI  - Technology 

Mediation  between  Carriers, 
Ministries,  BNetzA  and  LEAs 

20  years  of  experience  in  the 
Protocol-  / Performance- 
Analysis  of  Data-  / Voice- 
Networks 


Life  Cycle  of  Companies  inside  IT-  Industry 

• Usually,  only  some  very  large  Companies  do  exist  for  very 
long  Time 

• Small  and  Medium  Size  Companies  Appear  and  Disappear 

• But  there  are  some  exceptions. 


Why  ? 
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Old  Dutch  Saying 


• During  „Stormy“  (Windy)  Times 

• (and  over  the  last  20  years  we  had  such  times  inside  IT 
Market) 


some  are  building: 
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C0 


Protection  Houses 
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• And  others: 

• LikeDATAKOM 
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Windmills 
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DATAKOM  History 

NetworkOuality  for  customers. 

1986  Founding  of  DATAKOM  GmbH 

by  Paul  Hoffmann  und  Lydia  Krowka 

1988  Start  of  DATAKOM- Academy 

2000  Start  of  GTEN  AG  with  patented  Technology  for  Lawful  Interception 


Until  today 


[g]ten 

L J Intelligence  fora  better  world 


more  than  10  000  Installation  from  DATAKOM  and  GTEN 
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1986 

• Foundation 
of  DATAKOM 
GmbH 

• Extensive 
experience  in 
the  protocol/ 
performance 
analysis  of 
data/voice 
networks 


2002 

•Contract  with 
Telefonica 

•GTEN  becomes 
full  voting 
member  of 
ETSI 

•GTEN  New 
solution 
approved 
according  to 
BNetzA  and 
Dutch  TUT 


1997 

• Basic 

development 
of  GTEN 
technology 

• Mediation 
between 
carriers, 
ministries, 
BNetzA  and 
LEAS 


2003 

• Two  large  IP 
monitoring 
systems 
deployed  in 
North  Africa 
and  Middle  East 

• VoIP  LI  solution 
certified  by 
RegTP 


GTEN  - Division  History 


1999 

2000 

2001 

'Contract  with 

•Foundation 

•Transfer  of 

Mannesmann, 

of  GTEN  AG 

technology. 

ARCOR, 

•Contract  with 

patent  rights 

Deutsche 

Viag  Interkom 

and  customer 

Telekom  and 

contracts 

o.tel.o 

(later  on 
BTIgnite) 

• Enhancement 

'Initial 

of  existing 

certification  of 

•Investment 

GTEN  solution 

LI  solution  by 

backer  was 

towards  IP 

BMW! 

obtained  in 
the  form  of 
Wellington 
Partners 

applications 

2004 

2005/6 

'Introduction 

• Email  solution 

of  ATM 

certified  by  RegTP 

Interceptor 

•Contracts  with 

'Start  of 

Easynet,  KEVAG 

development  of  and  DIG 

email  solution 

• Enhancements  with 
existing 

Customer 

• Development 

new  Product 
Strategy 

•Cleaning  up 
Partner  Selection 

•Clean  Bandwith 
Concept 

(0 

(0 

© 
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What  is  happening  in  the  market  today? 

The  opportunity  lies  in  the  transformation  of  services. 


Transformation  of 
Legacy  Networks  to  Next  Generation 


..._T  tli 

IN  I 


Applications 


IP  Data 
Services 


IP  Services  & Control 


IP  Switching  & Routing 
Access  Layer 


Independent  Stove  Pipes  Converged  Network  Infrastructure 

Money  is  being  spent  to  maintain  the  functionality, 
usability  and  security  of  the  customer  offerings. 
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Bandwidth  Pressure  from  Next  Generation 

Applications 


ADDlication 

Downstream 

Upstream 

Streaming  Audio 

128K-384K 

64K 

Internet  Access 

256K-1.5M 

64K-640K 

Web  Hosting 

400K-1.5M 

400K-1.5M 

Video  Conferencing 

384K-1.5M 

384K-1.5M 

Distance  Learning 

384K-1.5M 

384K-1.5M 

Telecommuting 

1.5M-3M 

1.5M-3M 

Interactive  Video 

1.5M-6M 

128K-6M 

VoD 

1M-18M 

64K-640K 

Multiple  Digital  TV 

2M-8M 

64K-640K 

Multiple  VoD 

6M 

64K-640K 

HDTV 

6-1 8M 

64K 

Gaming 

2-20M 

64K  -20M 

Source:  Cisco  2005 
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IH  Migration  to  IP  is  Critical  for  Participation  in  the  IP 

Economy,  but  also  Transparency 
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The  pace  of  convergence  to  a common  IP  infrastructure  is  accelerating 

• New-age  IP  service  providers  have  distinct  advantages  over  incumbents 
e.g.  personalized  services 
faster  service  development  cycles 
^ More  granular,  bounded  service  levels 


Current  Method  of  Operations 


Target  Method  of  Operations 


Voice  Services 

Voice 
Applications 


Costly 

Slow  to  Market 
Closed 

One-size-fits-all 


Efficient 

Rapid  Response 
Open 

Personalized 
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Market  Conditions 

Networking  Focused  Increasingly  on  the  Content 


MAC  Header 


IP  Header  TCP 


Switch 


1/^ 


MAC  Header  IP  Header  TCP 


Router 


/ X 

MAC  Header 

IP  Header 

TCP 

Firewalls 


ia_ 


MAC  Header 


IP  Header 


PCs  & Servers  ^4  Bytes 


20  Bytes  20  Bytes 


Worms,  Content  (for  LI) 

User  Conversations 


Payload 


Payload 


Payload 


Payload 


48-8,192  Bytes 


P 


Solution  Complete  Visibility;  Network  Appliance  Speeds;  Configurable  Logic 
n/ 


MAC  Header  IP  Header  TCP 


Payload 
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Market  Conditions 
Technology  Challenges 


There  is  no  good  solution  available  to  enable  real-time 
content  control  incl.  Interception 

^ Routers/switches  are  content-blind,  closed  systems 

- Header,  not  payload 

- Pass  traffic,  don’t  analyze 

- functionality  is  fixed 

Appliances  are  point  solutions,  often  ASIC-based  and 
not  extensible 


Servers  (Sun,  Dell,  ...)  are  low  speed  and  add  latency 


network  services  & 


• The  rate  of  increase  for  network  transmission  speeds  and  volumes  is 
compounding  the  problem 
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Market  Conditions  Driving  10GbE  Depioyments 


• Broadband  data  is  exploding 

^ “At  the  end  of  March  2006,  42  percent  of  Americans  had  high-speed  at 
home,  up  from  30  percent  in  March  2005,  or  a 40  percent  increase.”  Pew 
Internet  Survey,  May  29,  2006 

• Next  generation  of  IP  services  are  bandwidth  hogs! 

^ VoD  estimated  at  1-1 8Mbps  downstream  (HDTV  6-1 8Mbps) 

Gaming:  2-20Mbps  downstream  (64Kbps-20Mbps  upstream) 

• lOGbE  switch  port  pricing  dropped  to  below  $1 ,000  per  port 

• DeirOro  predicts  that  over  the  next  five  years  23  million  lOGbE  ports 
will  ship,  worth  $14bn 
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Situation  regarding  Lawful  Interception 


• Technology  today  based  on  old  Network  Design 

• Handshake  Interfaces  between  Network  Provider  and 

Law  Enforcement  Agencies  are  designed  for  old  Telephone 
Networks  where  Content  and  Signaling  where  using  different 
Routes 

• Transport  of  Terrabytes  Data  towards  LEAs  very  often  useless 
and  expensive 

• New  Generation  Networks  ..Crying"  for  new  LI  - Technology 
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Many  (to  many)  standards 


Calea,  ETSI,  Sorm 

don‘t  make  things  better 


TC  LI  (Technical  Comitee  LI) 

* DTR/LI-00014  Lawful  Interception  of  WLAN  Internet  Access 

Beschreibt  die  Interception  Domain  und  die  Ausleitung  von  Wireless  Internet.  Wird  voraussichtlich  in  2006  herausgebracht. 

•k 

DTR/LI-00020  Data  Handover  Architecture 

Beschreibt  die  Architektur  fur  die  Ausleitung  von  Daten  (EU  Data  Retention  Act).  Wird  voraussichtlich  in  2006  herausgebraucht. 

★ 

DTS/LI-00024  Lawful  Interception; 

Service  specific  details  for  IP  Multimedia  Services  Spezifikation  fur  das  Handover  von  Voice  und  sonstigen  multimedialen  Diensten  in 
paketvermittelten  Netzen  (mit  und  ohne  IMS).  Wird  voraussichtlich  in  2006  herausgebraucht. 

★ 

DTR/LI-00025  Lawful  Interception; 

Architecture  for  IP  Networks  within  a Communincation  Service  Provider's  domain  Beschreibt  die  Architektur  fur  fur  LI  in  paketvermittelteten 
Netzen.  Wird  voraussichtlich  in  2006  herausgebraucht. 

★ 

DTS/LI-00030  Lawful  Interception; 

Service  specific  details  for  PSTN  Emulation  Services  (PES)  Spezifiziert  die  Ausleitung  von  Daten  aus  multimedialen  Netzen,  die  PSTN 
Emulation  System  Eigenschaften  besitzen  (legacy  TDM).  Wird  voraussichtlich  in  2006  herausgebraucht. 

k 

TISPAN  LI 

(Technical  Committee  - The  harmonisation  of  IP  Network  Architectures) 

k 

DTS/07013 

Telecoms  & Internet  converged  Services  & Protocols 
for  Advanced  Networks  (TISPAN); 

NGN  Lawful  Interception; 

Lawful  Interception  functional  entities,  information  flow 
and  reference  points 

Spezifiziert  wird  der  sog.  Point  of  Interception  fur  NGN  Netze.  Fur  das  Handover  wird  auf  die  Dokumente  TS  102  232  und  133.108  verwiesen. 
Wird  voraussichtlich  ende  2006  herausgebraucht. 

* Bereits  veroffentliche  Standards,  die  erweitert  werden  (Work  Items) 

Standards,  die  bereits  herausgebracht  und  von  europaischen  Staaten  adaptiert  sind. 

* TS  101  671 
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List  continued 


Handover  interface  for  the  lawful  interception  of  telecommunications  traffic  Erweiterungen  fur  PES  und  PSS  sind  in  Arbeit.  Wird 
verraussichtlich  in  2006  fertig.  Diese  Spezifikation  wird  schon  europaweit  von  Regulierungsbehorden  adaptiert. 


TS  102  232 


Lawful  Interception;  Handover  specification  for  IP  delivery 

Das  Handover  Interface  fur  IP.  Wird  in  Verbindung  mit  TS  102  233,  102  234,  102  815  und  LI-00024  verwendet.  Wegen  der  unterschiedlichen 
Einsatzgebiete  gibt  es  noch  Anpassungsbedarf.  Diese  Spezifikation  wird  schon  europaweit  von  Regulierungsbehorden  adaptiert. 

•k 

TS  102  234  Lawful  Interception; 

service  specific  details  for  internet  access  services 

* Wird  u.a.  fur  xDSL  Layer  3 Ausleitung  in  Verbindung  mit  TS  102  232  verwendet.  Erweiterungen  und  Verbesserungen  sind  geplant. 
Diese  Spezifikation  wird  schon  europaweit  von  Regulierungsbehorden  adaptiert. 

★ 

TS  101  909-20  Part  I 

Digital  Broadband  Cable  Access  to  the  Public  Telecommunications  Network;  IP  Multimedia  Time  Critical  Services;  Part  20:  Lawful 
Interception;  Sub-part  1 : CMS  based  Voice  Telephony  Services 
★ 

TS  101  909-20  Part  II 

Digital  Broadband  Cable  Access  to  the  Public  Telecommunications  Network;  IP  Multimedia  Time  Critical  Services;  Part  20:  Lawful 
Interception;  Sub-part  2:  Streamed  multimedia  services 

LI  in  Breitband  Kabelfernsehen  Hybrid  Fibre/Coaxial  (HFC)  Datennetzen.  Die  Spezifikationen  beschreiben  die  Ausleitung  von  Telefonie  und 
Daten.  Diese  Spezifikation  wird  schon  europaweit  von  Regulierungsbehorden  adaptiert. 


TS  101  331  Telecommunications  security; 

Lawful  Interception;  Requirements  of  Law  Enforcement  Agencies  Die  Anforderungen  fur  die  Behorden.  Das  Dokument  wird  regelmaBig  an 
die  zu  berucksichtigenden  Gegebenheiten  angepaBt.  Diese  Spezifikation  wird  schon  europaweit  von  Regulierungsbehorden  adaptiert. 

* 3GPP 

* 133.108  UMTS  3G  Security; 

Handover  Interface  for  Lawful  Interception 

Spezifiziert  wird  das  Handover  Interface  fur  UMTS  mit  IP  Multimedia  Subsystemen.  Diese  Spezifikation  wird  schon  europaweit  von 
Regulierungsbehorden  adaptiert. 

•k 

133.107  UMTS  3G  Security; 

Architecture  for  Lawful  Interception 

Spezifiziert  wird  das  Intercept  Domain. 

Diese  Spezifikation  wird  schon  europaweit  von  Regulierungsbehorden  adaptiert. 
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Old  LI  - Technical  Design 

• GTEN  has,  like  other  LI  - Vendors,  developed  many  LI-  Solutions 
“dictated”  by  National  Standards 

• Result  of  many  existing  Standards  for  Network  Provider: 

Buying  LI-  Only  - Products  very  often  means  creating  Cost  only 
and  no  ROI  (Return  on  Investment) 

• Now  we/you  have  the  big  chance  to  change  this  to: 

• Network  Provider  buying  the  right  Technology  will  see 
better  Performance  plus  good  Portion  of  ROI  and  will  get 

Lawful  Interception  Solution  for  very  low  Cost  or  no  Cost 
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Modular  Concept  = Excellent  Solution 

but  based  on  old  "Legacy  Network"  Design  tlN 


X.25 


ISDN  — 


Internet 


LEA1 


LEAn 


LEMFn 
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Hand  Shake  Interfaces,  designed  many  years  ago  for  voice  application 


Functional  Units 


Level 

Operator 
Interface 

Management 

Provisioning 


Delivery 
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Back-end  ■ Front-end 


LI  - Product  Environment  as  Result  of  Old  “Standards” 
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Reasons  for  taking  a new  direction 


• If  you  want  to  create  a innovative  soiution, 

you  have  to  study  current  soiutions  and  theyr  iimits 

• Together  with  a friend  (Dr.  Kornel  Terplan)  i have  written  a book  last  year 
describing  LI  - Technology  and  Methods  plus  Solutions  from  all  over  the  world 

• As  a result  of  the  gained  Knowledge  our  new  LI  - Technology  Concept  was  born 
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Information  Technology 

Intelligence 
Support  Systems 

Technofogl&s  for  Lawful  Intercepts 

Paul  Hoffmann  and  Kernel  Terplon 

Intelligence  Support  Systems:  'lechnologies  for  Lawful  Intercepts  addresses  the 
information  and  intelligence  needs  of  service  providers,  law  enforcement  agencies, 
representatives  of  governments  and  international  standards  bodies,  and  product  and 
serv  ice  vendors. 

This  volume  offers  solutions  for  many  technological  challenges,  explaining  how  to 
provide  networking  equipment  and  probes  for  lawful  intercepts,  and  detailing  meilxxis 
f<ir  reducing  the  performance  impiicts  on  network  equipment  that  result  from  intercepts. 
It  explores  how  to  access,  collect,  and  deliver  information  in  real-time  and  how  to 
improve  mediation  cITiciency  while  serving  multiple  functions.  The  biK)k  alsti  covers 
data  retention  and  preservation  issues  and  examines  how  to  standardize  intercept 
technologies  for  various  service  portfolios  and  infrastructure  components. 

Focusing  on  intelligence  support  systems  (ISS).  the  text  demonstrates  how  the 
information  that  an  ISS  gathers  can  be  applied  toward  security,  and  illustrates  how 
an  ISS  interfaces  with  billing,  ordering,  provisioning,  authenticating,  and  law- 
enforcement  systems. 

Features: 

• Addresses  the  intelligence  needs  of  service  providers,  law  enforcement, 
government,  and  vendors 

• Presents  ISS  basics  and  sumntari/es  law  enforcement  requirements.  legal 
background,  and  law  ful  intercept  amhitectures 

• Covers  service  portfolios,  networking  technologies,  and  infra.structurc  components 

• Kxamines  lawful  intercept  fnuiKworks  aiul  uk)Is  otTcred  by  vendors,  and  pnw  ides 
case  studies  of  ISS  solutions  for  various  technologies 

• Discusses  operational  principles  and  technical  recommendations  for  the  U.S.. 
Europe,  and  Japan 

• Explains  cost  components,  positive  business  models,  and  cost  reimbursement 
strategies 

• Explores  outsourcing  issues,  consulting  n>les.  sourcing  guidelines,  and  contract 
management  issues 


A 


Auerbach  Publications 

Tiytof  h ncis  Croup 

WWW  t«ylor«r>d(ianci}.cem 


AUE655 

ISBN  0-fl4R3-5aSS-l 
90000 


80849  328556 
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Terplon 


A 


Auerbach  Publications 

Tdytof  & FrjrKit  Croup 


Paul  Hoffmann  and  Kernel  Terplan 


Intelligence 
Support  Systems 

Technologies  for 
Lawful  Intercepts 
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Advice  for  innovative  IP  Network  Provider 
in  Near  - and  - Middie  East/Africa: 


• Dont  implement  old  Standards  which  are  made  for  old 
Networks 

• This  is  easy  for  those  who  dont  have  to  implement  standards 
like  GALEA,  ETSI  etc. 

• And  even  more  easy  for  new  IP  - Network  Provider 
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IH  Today’s  Network  Infrastructure  inadequate  for 

Service  Control  Needs 


• Devices  optimized  for  OSI  Layers  2-4  processing 

• Router  performance  suffers  as  intelligence  functionality  is  added  & 
turned  on 

• Pace  of  feature  enhancements  too  long  to  support  needed  roll-out  and 
competitive  response  timetables 

• Provisioning  fixed-function  appliances  for  required  network  intelligence 
is  cost  prohibitive  and  risky 


Market  Conditions  Summary: 

Responding  to  End-User  Expressed  Issues 
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Application  layer  attacks  and  service 
protocols  demand  deeper  packet 
inspection  & analysis  & LI  - Function 

General  purpose  computing  solutions 
have  hit  a performance  ceiling 

The  fixed-function  appliances  model 
does  not  scale 


Network  infrastructure  equipment 
features  are  slow  to  evolve  and  limit 
customer’s  ability  to  build  competitive 
advantages  for  their  business 
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Payload 


Partial  SQL  Slammer 
Worm  Packet 
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IP  Network  - Solution  Domains  with  LI  as  Part  of  the  Job 


Content  Control 

Intercept 
& Control 

Security  & DDoS 
Protection 

Content  Control  Engine 
Anti-virus  Signature  Engine 


Z. 


u 

o 

A-l 

o 

(L 

o 


in 

IS 


(A 

0) 

u 

'E 

o 

in 

** 

a 

o 

u 

0) 


(Q 


0) 

E 

o 

o 

Im 

o 

c 

lU 

> 

o 

o 

CL 

in 

o 

a 


Monitoring 

VoIP  SIP  Protection 

VoIP  and  other  LI 


c 

0) 

E 

in 

in 

0) 

in 

in 

< 

in 

o 

o 

t 

o 

in 

& 

o 

> 


u 

o 

o 

k 

CL 

in 


■o 

ra 

3 

o 

> 


U 

0) 

in 

o 

> 

o 


■o 

o 

n 

0) 

o 

^ Vi 

c o 

“ in 

*D  c 
o o 
o in 
a 
in 


8) 
■ ■■ 

X 


Q 

O 


z 


Flow  Identification 
Signature-based  IDS 
Anti-virus  Sig.  Engine 
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Market  Conditions 
An  Underserved  Market  Segment  Revealed 


▲ 

I 


Single-Function  Flexible 

Fixed-Function  Multi-Function 
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IP  Services  Control 
GTEN  taking  care  for  old  and  new  demands 


[o]ten 


Service  Control 
■ L2-L7  analysis 

• P2P  Control 

• Tiered  Services 


Transport 


Security 

* State  & flow  tracking 

• In-line  filtering/blocking 

■ Signature  detection 

■ Protocol  anomaly 
detection 

• Traffic  anomaly 

* Combined  functions 


■ Aggregation 

■ Routing 

■ Switching 


31 


Carrier/LEA  Re-Thinking  Appiiance  Strategies 


Fixed -function 


Appliances 


IP  Services 

Delivery  Requirements 


•Interception  as 
part  of  Service 
Delivery 

• Peer-2-Peer  Ctrl 
•VoIP  Control 
•Content  Filter 
•Traffic  Analysis 
•Access  Control 
•Security  Apps 


Adaptable,  Scalable 
Processing  Resources 


"Applying  the  development  approach  from  IT  software  industry  to  telecoms" 
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The  right  LI  - System  partner  helps  Carrier  to  make  money 


LI  - System  not  longer  an  „iland“  without  Return  on  Investment 
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Improve  Average  Revenue  Per  User 

• Offer  content  based  value  added  services 

• Per  user  features,  control  and  SLAs 

• Security  Services  - DDoS,  VoIP,  AV 

• VolP/IMS  Services  - Peering,  Personalized 

• Traffic  Management  - QoS,  Optimization 

Reduced  Capital  Expenses 

• Multiple  Services  Per  Device 

• Lower  CAPEX  Cost  Per  Megabit  of  Service 

• Longer  Deployment  Life  in  Network 

• Support  More  Users  with  Existing  Network 

Reduce  Operational  Expenses 

• Manage  peering  & transit  costs 

• Reduce  cost  per  service  per  megabit 

• Reduce  cost  to  deploy  new  services 

• Improve  efficiency  of  network  resources 
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Value  Proposition 


New  Multi- 

Media 

Services 


Easy  Service 
Integration, 
CreatKxi  and 
Execution 

Profitable 
investment 
into  IP 
technology 


Market  IMS  Value  Proposition 
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Managed  Services  Infrastructure: 
Value  Added  Services  Scenario 
Network  Provider  may  offer  Clean  Bandwidth  Service  for  Customer.  Example: 


• Revenue  opportunity 
directly  linked  with  pace 
and  number  of  services 
rolled-out 

• Capex  breakeven  in 
under  12  months  for 
each  service 

• Differentiate  your 
business  via: 

^ Services  mix 

^ Ease  of 
deployment 


Penetration  Rates 

75% 

75% 

100% 

100% 

90%  1 

Traffic  Reporting 

YEAR1 

YEAR  2 

YEAR  3 

YEAR  4 

YEAR  5 

Hardware  Expense 

$ 

430.000 

S 

- 

$ 

- 

$ 

- 

$ 

- 

Support  Expense 

$ 

64.500 

S 

64.500 

$ 

64.500 

$ 

64.500 

$ 

64.500 

Operational  Expense 

$ 

361.440 

$ 

361.440 

$ 

361.440 

$ 

361.440 

$ 

361.440 

Total  Expense 

$ 

855.940 

s 

425.940 

$ 

425.940 

$ 

425.940 

$ 

425.940 

Revenue 

$ 

903.600 

$ 

903.600 

$ 

903.600 

$ 

903.600 

$ 

903.600 

Net  Income 

$ 

47.660 

$ 

477.660 

$ 

477.660 

S 

477.660 

$ 

477,660 

DDoS  Mitigation 

YEAR1 

YEAR  2 

YEAR  3 

YEAR  4 

YEARS 

Hardware  Expense 

$ 

918.000 

s 

- 

$ 

- 

$ 

- 

$ 

- 

Support  Expense 

$ 

91.800 

s 

91.800 

$ 

91.800 

$ 

91.800 

$ 

91,800 

Operational  Expense 

$ 

1.084.320 

s 

1.084.320 

$ 

1.084.320 

$ 

1.084.320 

$ 

1.084.320 

Total  Expense 

$ 

2.094.120 

$ 

1.176.120 

$ 

1.176.120 

$ 

1.176.120 

$ 

1.176.120 

Revenue 

$ 

2.710.800 

$ 

2.710.800 

$ 

2.710.800 

$ 

2.710.800 

$ 

2.710.800 

Net  Income 

$ 

616.680 

$ 

1.534.680 

$ 

1.534.680 

$ 

1.534.680 

S 

1.534.680 

P2P  Traffic  Control 

YEAR1 

YEAR  2 

YEAR  3 

YEAR  4 

YEARS 

Hardware  Expense 

$ 

- 

$ 

760.000 

$ 

- 

$ 

- 

$ 

- 

Support  Expense 

$ 

- 

$ 

38.000 

$ 

38.000 

$ 

38.000 

$ 

38.000 

Operational  Expense 

$ 

- 

s 

722.880 

$ 

722.880 

s 

722.880 

$ 

722.880 

Total  Expense 

$ 

- 

$ 

1.520.880 

$ 

760.880 

$ 

760.880 

$ 

760.880 

Revenue 

$ 

- 

s 

2.710.800 

$ 

2.710.800 

s 

2,710.800 

$ 

2,710,800 

Net  Income 

S 

- 

s 

1.189.920 

$ 

1.949.920 

s 

1.949.920 

$ 

1.949.920 

VoIP  Traffic  Control 

YEAR1 

YEAR  2 

YEAR  3 

YEAR  4 

YEARS 

Hardware  Expense 

$ 

$ 

$ 

380.000 

$ 

- 

$ 

- 

Support  Expense 

$ 

$ 

$ 

38.000 

$ 

38.000 

$ 

38.000 

Operational  Expense 

$ 

$ 

$ 

481.920 

$ 

481.920 

$ 

481.920 

Total  Expense 

$ 

$ 

$ 

899.920 

$ 

519.920 

S 

519,920 

Revenue 

$ 

$ 

$ 

1.807,200 

$ 

1.807.200 

s 

1.807,200 

Net  Income 

$ 

$ 

$ 

907,280 

$ 

1.287.280 

$ 

1.287.280 

YEAR  1 YEAR  2 YEAR  3 YEAR  4 YEAR  5 


Net  Income  Projections 

$ 664,340 

$ 3,202,260 

$ 4,869,540 

$ 5,249,540 
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Back-end  ■ Front-end 


LI  - Product  Environment  from  yesterday 


□□□□ 

□□□□ 

nn 

□ □ 

□□□□ 

□ □ 

□□ 

□□□□ 

□ □ 

/ 

PSTN 


Public 

Internet 


ISDN 
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LI  - Monitoring  of  a complete  Country 
based  on  modern  IP  - Network  Requirements 


BAS  2 


2x  G 

amm  liB  Hi  lai  III  III 


mm  111  III  III  III  III  ii  2x  6-station  GE-Fiber  TAPs 


7x  Aggregator  GigE 


lx  Aggregator  FE 


IMC  location 


LTO-2  Archiving 
Changer 


2-lOx  POSEIDON  Analysis 
Archiving-Server  (exisiting  FE  POSEIDONs) 


10  X Analysis  Workstations 


37 


Part  of  the  Solution:  Reconstruction  of  Intercepted  Data 

(only  available  for  LEA,s) 


• Philosophy; 


• Transport  of  data  only  when  necessary 
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Login  Screen 
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Start  page  - Administrator 


POSEIDON  Applications 


• Non-intrusive  network  security  monitoring  system 

^ With  alerting  functions  on  user-defined  events 
^ With  WEB-GUI  (Administrator  and  User  View) 

• Collects,  records  and  analyses  IP-traffic  transported  through 
different  networks  like 

^ Ethernet  (as  well  Fast  and  Gigabit  Ethernet) 

^ ATM 
^ PCS 

E1/T1,  E3/T3 

• Collects,  records  and  analyzes  VoIP  calls 
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POSEIDON  Architecture 


PC  Browser 


Apache  WEB-Server 


rsor 


Recorder 


Kernel  (Free  BSD  4.2) 


GUI  Server  (Administrator  / 

^ seaunantj 

Query  Procesfe 


Statistics  Generator 


Interface  Modules  (only  receiving) 
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POSEIDON 


Reconstruction  of  IP-data 

- Protocols 

Frame  Relay,  HDLC,  Cisco  HDLC,  PPP,  BayPPP,  MLPPP,  VLAN  (ISL  & IEEE 
802. iq),  Ethernet  (IEEE  802.3),  IP,  ATM  & IP,  PoS  & IP,  WCP  and  STAC 
Compression  (MPLS  & IPv6  optional) 

^ Complete  Analysis  on  all  protocol  layers 

* PPP  (PAP,  IPCP,  LCP) 

Ethernet 

• IP 

• UDP 

• ICMP 

• TCP  - FTP 

- HTTP 

- SMTP 

- POPS 

- IMAP4 

- TELNET 

- CHAT  / IRC 

- VoIP  (optional) 

-•  Email  reconstruction  incl.  all  attachments 


-■  VoIP  reconstruction  [h.323v4  - H.225,  h. 245, q. 931,  rtp,  rtcp,  sccp, 

SIP,  MGCP(IPDC,  SGCP)] 
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List  of  all  sessions  - Applications 


Application  Reconstruction  - Microsoft  Internet  Explorer 


• Zuriick 


'd  El  ^ ! Qsuchen  [^Favoriten  ^Median  | I^-  SS  * 1—1 


^ - 


Application  Reconstruction 


Interface  |POS1-001.GTEN.COMfsf3 

Start  0 Relath/e:  pi^ 

End  0 Relative: 


3 


"if^  I 

Jg  I hour 


1 


i 


Do  DNS? 

Filter 

Search  String 


□ 


□ Case  Sensitive  □ Base64  Encoded 


Submit 


View  By  All  Applications  ▼ Top  N |20  Ira 
MClickto  generate  summary 


Applications 


f Web  Pages  ['Emails  |'ftp  j'chats  ^Sessions  | 


ID 

Start  Time 

Client  IP 

Server  IP 

Summary 

508 

03/16/2004  12:42:36 

213.217.105.66 

213.165.64.121 

• www67.gmx.net/de/cgi/gmxfunctians.js 

513 

03/16/2004  12:42:36 

213.217.105.66 

213.165.64.121 

• www67.gmx.net/de/cgi/mailnew 

514 

03/16/2004  12:42:42 

213.217.105.66 

217.212.240.118 

• www.saab.de/main/DE/de/dyc_step2.xmi 

515 

03/16/2004  12:42:33 

213.165.64.20 

213.217.105.66 

• Frem:"Jurgen  Greulich"  <juergen.greulichiggmx.de>  To:  namik.iayigigten.com  Sub:  Biid 

519 

03/16/2004  12:42:46 

213.217.105.66 

194.95.254.55 

9 www.bremen.de/web/owaj^_suche 

521 

03/16/2004  12:42:42 

213.217.105.66 

194.95.254.55 

• www.bremen.de/web/owa/p_suche www.bremen.de/web/owa/p_anz_suchfenster www.bremen.de/... 

526 

03/16/2004  12:42:44 

213.217.105.66 

217.212.240.118 

• www.saab.de/main/DE/de/dyc_step2.xml 

538 

03/16/2004  12:43:26 

213.217.105.66 

213.165.64.100 

• From:"Jiirgen  Greulich"  <juergen.greulich(ggmx.de>  To:  namik.iaygigten.com  Sub:  Biid 

539 

03/16/2004  12:43:26 

213.217.105.66 

165.254.12.101 

• dynamic.hotbar.eom/dynamic/hotbar/disp/3.0/sitedisp.dil 

541 

03/16/2004  12:43:26 

213.217.105.66 

194.95.254.55 

• www.bremen.de/Web/owa/p_a_z_topframe  www.bremen.de/Web/owa/P_A_bis_Z_Leiste 

543 

03/1 6/2004  12:43:36 

213.165.64.20 

213.217.105.66 

■ Frem:"Jurgen  Greulich"  <juergen.greulichggmx.de>  To:  peter.weinlichggten.com  Sub:  Biid 

544 

03/16/2004  12:43:36 

213.217.105.66 

213.165.64.121 

% www67.gmx.net/de/cgi/center 

545 

03/16/2004  12:43:37 

213.217.105.66 

213.165.64.121 

• www67.gmx.net/de/cgi/gmxfunctions.js 

561 

03/16/2004  12:43:41 

213.217.105.66 

213.165.64.121 

• www67.gmx.net/de/cgi/gmxfunctions.js 

562 

03/16/2004  12:43:41 

213.217.105.66 

213.165.64.121 

• www67.gmx.net/de/cgi/maiiindex 

572 

03/16/2004  12:43:42 

213.217.105.66 

209.225.34.135 

• ne.getit4u.cam/cgi-bin/hrint_temp.cgi 

573 

03/16/2004  12:43:26 

213.217.105.66 

194.95.254.55 

• www.bremen.de/Web/owa/P_A_bis_Z www.bremen.de/Web/owa/P_A_bis_Z 

574 

03/1 6/2004  12:43:45 

213.217.105.66 

213.165.64.121 

• www67.gmx.net/de/cgi/gmxfunctions.js 

582 

03/16/2004  12:43:44 

213.217.105.66 

213.165.64.121 

9 www67.gmx.net/de/cgijtnailprint 

Reconstructien  Options  Auto  View 


0 Show  Server  0 Show  Client 


View  Options  ▼ 


« Back 


Next» 


Total  204 
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List  of  emails  - Application  view 


Application  Reconstruction  - Microsoft  Internet  Explorer 
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Reconstructed  email  - Application 
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Reconstructed  email  - Application 


Reconstructed  email  - ASCII 
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Reconstructed  WEB-site  - Application 
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Voice  over  IP  session  list 
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VoIP  Playback  of  Voice  & Video 


VOIP  Calls  - Microsoft  Internet  Explorer 


■ Zuriick  » 


^ 41  di  Suchen  [M  Favoriten  Median  =^@’310, 


^2<1 


H323  Protocol  Ana^is 


Analysis  CDR  QoS  Help 


□ 


Data  Format: 


Niksun  dataset 


1 Call  View  | 

1 Message  View  | 

Packet  View  [ 

FtAS  View  1 

Update 


Calls 


Messages  in  Call  1 


Signalling  fMedia 
&£«d11nw|D*jajj^ 


Audio  / Video 
Playback  Buttons 


10.28.2.3»<-i=10 


0,000000  ] 

0,000000 

J 10.28.2.39,  1269 

Setup 

10.28.2.37,  1720  | 

0,188261 

0,188261 

10.28.2.39,  1269 

. Verting 

10.28.2.37,  1720 

5,204959 

5,016698 

10.28.2.39,  1269 

^ Connect 

10.28.2.37,  1720 

5,208230 

0,003271 

10.28.2.39,  1270 

^ Terminal  Capabilitv  Set 

10.28.2.37,  1393 

5,208230 

0,003271 

10.28.2.39,  1270 

tester  Slave  Determination 

10.28.2.37,  1393 

ifi 

Terminal  Capabilitv  Set  „ 

10.28.2.37,  1393 

Pg.#1 


M^er  Slave  OetefTT^ination  1D.28.2.37,  1393 


Fields 

Packets 

Message  Elements 


Setup 

Arrival  Time:  4/22/2004  8:57:51 .6601 27 
Packet  Length:  289 
9 Q931 

Protocol  Discriminator:  Q.931 
Cali  Reference  Value  Length:  2 
CRef  Flag:  destination 
Cali  Reference  Value:  2751 7 
Message  Type:  Setup 
9 Bearer-Capability 
Length:  3 

Coding  Standard:  iTU-T  Standardized  Coding 
Information  Transfer  Capability:  Unrestricted  Digitai  Information 
Transfer  Mode:  Packet  Mode 
Information  Transfer  Rate:  Packet  Mode 


I 
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LI  - Monitoring  of  a complete  Country 
Based  on  modern  IP  - Network  Requirements 


BAS  2 


2x  G 

amm  liB  Hi  lai  III  III 


mm  111  III  III  III  III  ii  2x  6-station  GE-Fiber  TAPs 


7x  Aggregator  GigE 


lx  Aggregator  FE 


IMC  location 


LTO-2  Archiving 
Changer 


2-lOx  POSEIDON  Analysis 
Archiving-Server  (exisiting  FE  POSEIDONs) 


10  X Analysis  Workstations 
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New  Services  Offerings  Requiring  up  to  10GbE  Depioyment  in 
Aggregation  Points.  LI  can  be  buiid  inside  same  “Service  Points” 


Access  Network 


Aggregation  Network 


lOGbE  rolling  out  in  the 
aggregation  network 

Optimal  location  for  Service 
Control  & Policy 
Enforcement  + Interception 


Requiring  lOGbps  of: 
Inspection; 
Classification;  and 
Control 


CIR  is  forecasting  the  market  for  10-Gbps  ports  on  telecommunications 
and  data  communications  equipment  will  grow  from  221,000  ports  in  2006 
to  1.2  million  by  2010;  Light  Reading,  Nov  2005. 
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Functional  Architecture  of  modern  Aggregation  Units 


Northbound 

APIs 


Service 

Modules 


System  APIs 
Built-in  Security 


Line  Rate 
Execution 
Resources  & 
Controls 


APIs 

(Soap,  HTTPS,  RMON,  ODBC,  ?) 


Party 

Svc  Modules  & 
Applications 

MLS 

Guard 

K 

DoS 

Mitigation 


Svc  #1 


Svc  #2 


Svc  #3  Svc  #4 


System  APIs 
System  Security 


Content 
& RegEx 
Enaines 
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Linux-based  OS 
RAVE  Virtual  Machine 

Protocol  p Silicon 

Accelerators  Database 

Accelerator 


• A Few  Application  Example  out  of  many  possible  ones  for  the 
new  -All  in  One  Plattform-: 
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Traffic  Mirroring  / Intercept 

Selective  Interception,  Replication,  Session  Hijacking 
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GS-4000  Traffic  Monitoring: 


P2P  Call 


Controlled  IP  Network 
Selective  Monitoring 
Through  Application 
Layer  Route  Manipulation 


Multiple  Deployment  Methods 

- Passive  Tap  Deployment  with  Intercept  & 

Arrival  Rate 

- Span  Port  with  Inject  Path  for  Session 

Controls 

- Active  In-line  for  Selective  Session  Controls 

- HW  Raw,  MAC  or  GRE  Distribution 

- SW  Custom  Delivery  (iSCSI,  FC/IP) 

Multiple  Targeting  Mechanisms 

- Flow  Targeting  (Webmail  Sessions) 

- Content  (Any  Packets  w/BOMB) 

- Content  Flow  (Bad  Conversations) 

- Non-Port  Protocol  (SIP,  Skype) 

- Circuit  / 5-Tuple  (MPLS,  VLAN,  etc.) 


Traditional  IP 
Traffic  Mirroring 
and  Monitoring 


tliMlIiiiifeil 


Network  Observstory 


Do  you  know  tuftei  s on 

your  neh>ork  ? 


AH  <Hspt6y  imogoa  shown  ore  cifecUy 
from  Network  Obsonmtory. 


Algorithm  Based  Reporting 

- Packet  Accurate  Netflow,  IPFix 

- Host  Fingerprinting 

- Custom  Traffic  Profiling 


GTEN  has  significant  Government  & 
Carrier  Experience  with  numerous 
GTEN  & Partner  Solutions  in 
"Traffic  Mirroring" 
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Solution  Example:  Managed  Multi-User  Firewalls 

Carrier  Network  Deployment  & Provisioning 


OSS  Provisioning 

ti 


Aggregation 

Routers 


GS-4000  Multi-User  Firewalls 


Attack  Target 


Service  Provider  Firewall  Hallmarks: 

• Multiple  Independent  Rule  Sets 

- Per  Subscriber  Rule  Sets 

- Mobility  (Rule  Sets  Move  As  Needed) 

- Secure  Separation  of  Rule  Space 

• Service  Provider  Subscriber  Definition 

- IP  Blocks 

- MPLS 

- VLAN  (Virtual  WAN/LAN  Interfaces) 

• Scalability  & Capacity  Planning 

- Multi-Gigabit  Performance 

- Customer  Flow  Capacity  Control 

- Customer  Policy  Capacity  Controls 

- No  Flow/Policy  Degradation 

Multi-User  Firewalls  Are  Different: 

• 7-Tuple  Customer  Policy  Definitions 

- SIP,  DIP,  SP,  DP,  Proto,  VLAN,  MPLS 

• Policies  Provisioned  Per  Customer 

• OSS  Policy  Provisioning  (SOAP) 

• Dynamic  Policy  Migration 

• Dynamic  Customer  Detection  (DHCP) 

• Transparent  & Transparent  NAT/PAT 

• Asymmetric  State  Synchronization 

• IPv6,  Encapsulation,  Multi-L2/2.5 
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Solution  Example:  Malware  Mitigation 

In  the  network  content  inspection  & control 

Content  Control  Characteristics: 

• Malware  Mitigation 

- Web  Anti-Virus  (Kaspersky,  etc.) 

- Web  Protection  and  IPS 

- Adware,  Spyware,  Bots 

- Email,  Webmail,  FTP 

• Service  Provider  Characteristics 

- Stealth  Network  Deployment 

- Fault  Tolerant  Deployments 

- Multiple  Gigabit,  Any  Rule  Quantity 

- Hitless  Active  Rule  Provisioning 

• Other  GS-4000  Differentiators 

- Stream  Re-Assembly  with  Asymmetric 
Route  Recovery 

- Selective  Subscriber  Deployment 
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1101001011 


thatsme@ 


confidential 


Payload  1 


jesM 

Payload  2 


Payload  3 


payload  match  table  for  DROP  message 

-MAIL  FROM:  (email  header) 
-thatsme@mycompany.com  (Fr:  username) 
-MAIL  TO:  (email  header) 

-NOT @mycompany.com  (To:  username) 
-My  Company  Confidential  (footer) 


a 
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Solution  Example:  DDoS  Mitigation 

Multi-Function,  Multi-Customer  DDoS  Mitigation  Solution 


PeakFlow  SP  / MSM 


Border 

Routers 


Backbone 

Routers 


CE  Routers 


GS-4000  Mitigation  Servers 


NetFlow  Data 
Filter  Instructions  ^ 
Sampled  Traffic  ^ 
iBGP  Route  Update  ^ 


Attack  Target 


Market  Leading  Mitigation: 

• Supports  Multiple  Analysis  Vendors 

- Arbor  Networks  plus  Open  API 

• Scalable  Deployments 

- BGP  Peered  & Clusters 

- Multiple  Gigabits  Per  Blade 

- Shared  Mitigator  Deployment 

• Flexibility 

- Extensible  Mitigation  Techniques 

- Netflow  Generation 

- Content  Based  Scrubbing 

- Additional  Services  Capabilities 

Broadest  Built-in  Attack  Filters: 

• SYN  & ACK  Floods  (Fastest  Proxies) 

• Invalid  TCP  (SYN-FIN,  fin,  SYN-RST  and  TCP-Null) 

• DNS  Floods  (Patented) 

• Fragmentations  (UDP,  TCP,  ICMP) 

ICMP  Floods 

• Zombie  Attacks 

• Worms 

• Bogon/  Private  IP  Space 

• Block  Large  Frames  (>1500,  >9000) 

• TCP  with  Empty  Payload 

• Layer  7 Attacks  (Patented) 
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Benefits: 


• Plattform  allows  to  run  many  standard  jobs  beside  LI  simultan 

• Plattform  allows  to  implement  individual  customer  solutions 

• Piattform  wiil  not  ioose  a single  „bit“ 

• Plattform  internal  delay  very  small 
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CS-2000/GS-4000  Processing  Pipeline 


Linux  Management  Server 
Management 
Visualization 
Collaboration 

Data  APIs 

(Reporting  / Provisioning) 
DPPM 


CSlUCOfcD 

DATABASE 


Enginei 


■. : : 


RAVE  Appiication  Logic 

^ ^ ♦ ♦ 


s 
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IH  Migration  to  IP  is  Critical  for  Participation  in  the  IP 

Economy,  but  also  Transparency 
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The  pace  of  convergence  to  a common  IP  infrastructure  is  accelerating 

• New-age  IP  service  providers  have  distinct  advantages  over  incumbents 
e.g.  personalized  services 
faster  service  development  cycles 
^ More  granular,  bounded  service  levels 


Current  Method  of  Operations 


Target  Method  of  Operations 


Voice  Services 

Voice 
Applications 


Costly 

Slow  to  Market 
Closed 

One-size-fits-all 


Efficient 

Rapid  Response 
Open 

Personalized 
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■isyi'X, 


Thank  you  very 
much  for  your 
interest 


2007  GTEN 


